GitHub Advisory DatabaseGHSA-VQ79-MGPX-2WX4Apache Struts Access Control Redirect
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.009 Low
EPSS
Percentile
82.8%
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.struts:struts-parent | le | 2.3.28.1 |
References
jvn.jp/en/jp/JVN45093481/index.html
jvndb.jvn.jp/jvndb/JVNDB-2016-000113
www-01.ibm.com/support/docview.wss?uid=ssg1S1009282
www-01.ibm.com/support/docview.wss?uid=swg21987854
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
bugzilla.redhat.com/show_bug.cgi?id=1348252
github.com/advisories/GHSA-vq79-mgpx-2wx4
github.com/apache/struts/commit/eccc31ebce5430f9e91b9684c63eaaf885e603f9
nvd.nist.gov/vuln/detail/CVE-2016-4431
struts.apache.org/docs/s2-040.html
web.archive.org/web/20210123145002/www.securityfocus.com/bid/91284
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.009 Low
EPSS
Percentile
82.8%